
Case-A: Timing side-channel. The attacker can get accurate operator latency information for each time step. For example, the cycle information for each issued operator is acquired in [1]}, [2]}. This case naturally includes Electromagnetic (EM) side-channel [3]}, as the EM reflects the cycle information of each operator.

Case-B: DRAM side-channel. The attacker has access to the DRAM read/write information of each operator, as well as the latency through PCIE side-channel [4]}, [5]}.

Case-C: Cache side-channel. The attacker enables context-switching side-channel [6]} or exploits the collocation [7]} side-channel. By profiling spy applications, the attacker samples the cache performance counters of the target applications and uses it to extract cache performance, DRAM transactions, latency of the target kernels, etc. The additional cache performance counters in case C include L1 cache and L2 cache utilization, hit rate and read and write data volumes.

